Agradecimientos:
This work was supported by the MINECO – Spain grant: TIN2013-46469-R (SPINY: Security and Privacy in the Internet of You) and the CAM – Comunidad Autónoma de Madrid grant S2013/ICE-3095 (CIBERDINE: Cybersecurity, Data, and Risks).

Resumen:

In the last years there has been a considerable growth on the number of users id on-line banking (Szopinski, 2016). Banks must implement strong security solutions and users have to feel safe about the security offered. To securize the users' access, virtual keIn the last years there has been a considerable growth on the number of users id on-line banking (Szopinski, 2016). Banks must implement strong security solutions and users have to feel safe about the security offered. To securize the users' access, virtual keyboards are commonly used. Unlikely, virtual keyboards are vulnerable to shoulder surfing and malicious software-based attacks such as malware and Trojans (Nadkarni et al., 2011; Sapra et al., 2013). In this article we propose a Hardware Trojan (HT), which targets a VGA display and is able to reveal the private information clicked by the user on a virtual keyboard. This HT is very harmful since it defeats the countermeasures (e.g., keyboard mutation or obfuscation) generally used to combat malicious pieces of software (Nayak et al., 2014; Parekh et al., 2011; Rajarajan et al., 2014).[+][-]